CVE-2012-5885Medium· 5.0▾ Sunlit

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka …

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score29/ 100 · Low

impact 27.5 · likelihood 1.8 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Nov 17, 2012

Updated

Oct 9, 2026

CVSS

5.0

Vendor

apache

Product

tomcat

CWE

CWE-264

Depth score

29 · Low

EPSS

9.0% · p95

Platforms

—

Source

NVD

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

CISA SSVC

decided 2026-10-09

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 9.

9.0% → 9.0%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 5074 days

Nov 17, 2012Published
Disclosed via NVD
Oct 9, 2026Record revised
Last analysed / modified upstream
Oct 9, 2026EPSS first tracked
9.0%

apache CWE-264 #nvd #cve.org

Affected

tomcat = 5.5.0
tomcat = 5.5.1
tomcat = 5.5.2
tomcat = 5.5.3
tomcat = 5.5.4
tomcat = 5.5.5
tomcat = 5.5.6
tomcat = 5.5.7
tomcat = 5.5.8
tomcat = 5.5.9
tomcat = 5.5.10
tomcat = 5.5.11
tomcat = 5.5.12
tomcat = 5.5.13
tomcat = 5.5.14
tomcat = 5.5.15
tomcat = 5.5.16
tomcat = 5.5.17
tomcat = 5.5.18
tomcat = 5.5.19
tomcat = 5.5.20
tomcat = 5.5.21
tomcat = 5.5.22
tomcat = 5.5.23
tomcat = 5.5.24
tomcat = 5.5.25
tomcat = 5.5.26
tomcat = 5.5.27
tomcat = 5.5.28
tomcat = 5.5.29
tomcat = 5.5.30
tomcat = 5.5.31
tomcat = 5.5.32
tomcat = 5.5.33
tomcat = 5.5.34
tomcat = 5.5.35
tomcat = 6.0
tomcat = 6.0.0
tomcat = 6.0.1
tomcat = 6.0.2
tomcat = 6.0.3
tomcat = 6.0.4
tomcat = 6.0.5
tomcat = 6.0.6
tomcat = 6.0.7
tomcat = 6.0.8
tomcat = 6.0.9
tomcat = 6.0.10
tomcat = 6.0.11
tomcat = 6.0.12
tomcat = 6.0.13
tomcat = 6.0.14
tomcat = 6.0.15
tomcat = 6.0.16
tomcat = 6.0.17
tomcat = 6.0.18
tomcat = 6.0.19
tomcat = 6.0.20
tomcat = 6.0.24
tomcat = 6.0.26
tomcat = 6.0.27
tomcat = 6.0.28
tomcat = 6.0.29
tomcat = 6.0.30
tomcat = 6.0.31
tomcat = 6.0.32
tomcat = 6.0.33
tomcat = 6.0.35
tomcat = 7.0.0
tomcat = 7.0.1
tomcat = 7.0.2
tomcat = 7.0.3
tomcat = 7.0.4
tomcat = 7.0.5
tomcat = 7.0.6
tomcat = 7.0.7
tomcat = 7.0.8
tomcat = 7.0.9
tomcat = 7.0.10
tomcat = 7.0.11
tomcat = 7.0.12
tomcat = 7.0.13
tomcat = 7.0.14
tomcat = 7.0.15
tomcat = 7.0.16
tomcat = 7.0.17
tomcat = 7.0.18
tomcat = 7.0.19
tomcat = 7.0.20
tomcat = 7.0.21
tomcat = 7.0.22
tomcat = 7.0.23
tomcat = 7.0.25
tomcat = 7.0.28

Full technical detail▾

Overview

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.

Affected

tomcat = 5.5.0
tomcat = 5.5.1
tomcat = 5.5.2
tomcat = 5.5.3
tomcat = 5.5.4
tomcat = 5.5.5
tomcat = 5.5.6
tomcat = 5.5.7
tomcat = 5.5.8
tomcat = 5.5.9
tomcat = 5.5.10
tomcat = 5.5.11
tomcat = 5.5.12
tomcat = 5.5.13
tomcat = 5.5.14
tomcat = 5.5.15
tomcat = 5.5.16
tomcat = 5.5.17
tomcat = 5.5.18
tomcat = 5.5.19
tomcat = 5.5.20
tomcat = 5.5.21
tomcat = 5.5.22
tomcat = 5.5.23
tomcat = 5.5.24
tomcat = 5.5.25
tomcat = 5.5.26
tomcat = 5.5.27
tomcat = 5.5.28
tomcat = 5.5.29
tomcat = 5.5.30
tomcat = 5.5.31
tomcat = 5.5.32
tomcat = 5.5.33
tomcat = 5.5.34
tomcat = 5.5.35
tomcat = 6.0
tomcat = 6.0.0
tomcat = 6.0.1
tomcat = 6.0.2
tomcat = 6.0.3
tomcat = 6.0.4
tomcat = 6.0.5
tomcat = 6.0.6
tomcat = 6.0.7
tomcat = 6.0.8
tomcat = 6.0.9
tomcat = 6.0.10
tomcat = 6.0.11
tomcat = 6.0.12
tomcat = 6.0.13
tomcat = 6.0.14
tomcat = 6.0.15
tomcat = 6.0.16
tomcat = 6.0.17
tomcat = 6.0.18
tomcat = 6.0.19
tomcat = 6.0.20
tomcat = 6.0.24
tomcat = 6.0.26
tomcat = 6.0.27
tomcat = 6.0.28
tomcat = 6.0.29
tomcat = 6.0.30
tomcat = 6.0.31
tomcat = 6.0.32
tomcat = 6.0.33
tomcat = 6.0.35
tomcat = 7.0.0
tomcat = 7.0.1
tomcat = 7.0.2
tomcat = 7.0.3
tomcat = 7.0.4
tomcat = 7.0.5
tomcat = 7.0.6
tomcat = 7.0.7
tomcat = 7.0.8
tomcat = 7.0.9
tomcat = 7.0.10
tomcat = 7.0.11
tomcat = 7.0.12
tomcat = 7.0.13
tomcat = 7.0.14
tomcat = 7.0.15
tomcat = 7.0.16
tomcat = 7.0.17
tomcat = 7.0.18
tomcat = 7.0.19
tomcat = 7.0.20
tomcat = 7.0.21
tomcat = 7.0.22
tomcat = 7.0.23
tomcat = 7.0.25
tomcat = 7.0.28

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org